361467 - Crash [@ js_watch_set] with certain watcher functions

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

js> this.watch('x', print); x = 5;
x undefined 5
Bus error

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000004

Thread 0 Crashed:
0   js 	0x00024304 js_watch_set + 928 (jsdbgapi.c:386)
1   js 	0x0009b280 js_Interpret + 16404 (jsinterp.c:2953)
2   js 	0x00095d34 js_Execute + 960 (jsinterp.c:1643)
3   js 	0x00021564 JS_ExecuteScript + 64 (jsapi.c:4194)
4   js 	0x000031c4 Process + 904 (js.c:268)
5   js 	0x00003d8c ProcessArgs + 2304 (js.c:490)
6   js 	0x0000a210 main + 640 (js.c:3098)
...

I'm testing with the patch for bug 361346.  I haven't tested to see if this crash occurs without it.

Comment 1

[Brendan Eich [:brendan]]

I'm fixing this forthwith.

/be

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

There's no guarantee that we have a scripted function. I should have seen this earlier.

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 246249 [details] [diff] [review]
Fix

D'oh, mrbkap is too fast for me!

Looks like the 1.8 branch jsdbgapi.c needs some love, in several places.

/be

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Fixed on trunk.

Comment 5

[Brendan Eich [:brendan]]

Comment on attachment 246249 [details] [diff] [review]
Fix

Necessary null defense, automatic approval ;-).

/be

Comment 6

[Bob Clary [:bc] (inactive)]

Note to self: don't verify this until bug 361346 is fixed.

RCS file: /cvsroot/mozilla/js/tests/js1_5/Regress/regress-361467.js,v
done
Checking in regress-361467.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-361467.js,v  <--  regress-361467.js
initial revision: 1.1
done

Comment 7

[Brendan Eich [:brendan]]

Comment on attachment 246249 [details] [diff] [review]
Fix

Fixed on the 1.8 branch along with bug 361360 (this is a null-defense followup patch to that bug's patch).

/be

Comment 8

[Bob Clary [:bc] (inactive)]

Looks like there was an underlying assert lurking on all branches. See Bug 361856. 

Comment 9

[Bob Clary [:bc] (inactive)]

verified fixed 1.8.1, 1.9.0 linux/mac*/windows.